s3:auth: add comment to nulling out stolen sampass